India's Digital Personal Data Protection Act, 2023 became workable when the government notified the DPDP Rules in November 2025, starting an 18-month rollout that ends on 13 May 2027. For a startup that collects names, phone numbers or payment details, the stakes are concrete: the Act's Schedule allows penalties of up to ₹250 crore for failing to protect personal data. This guide sets out what applies, when, and what to build first.
What the DPDP Act and Rules cover
The DPDP Act governs digital personal data: information about an identifiable person that is collected online, or collected offline and later digitised. A business that decides why and how such data is processed is a data fiduciary. The person the data is about is the data principal. Most startups are data fiduciaries for their own customers and employees, and may act as data processors when they handle data on behalf of a client.
The Act set the principles, and the DPDP Rules, 2025 supply the operating detail, such as notice content, breach reporting steps and retention periods. The Rules were notified with a date of 13 November 2025. Until the main obligations start, the older framework under Section 43A of the IT Act continues to apply, according to a Khaitan & Co analysis of the notification.
The phased timeline: what applies when
The Rules switch on in three stages. Provisions that set up the Data Protection Board of India took effect immediately. Rules for consent managers start one year after notification. The substantive duties that most startups care about, including notice, consent, security safeguards and breach reporting, start 18 months after notification. As of this writing in November 2026, the second stage is days away.
In January 2026 MeitY consulted industry on shortening the general compliance window from 18 months to 12 months, which would have moved the final date to 13 November 2026, with comments sought by 4 February 2026. The sources reviewed for this guide describe this as a proposal only. Check the MeitY website for any amendment before you plan around either date.
| Stage | Date | What starts |
|---|---|---|
| Phase 1 | 13 November 2025 | Data Protection Board, its procedures and the government's rule-making powers |
| Phase 2 | 13 November 2026 | Registration and duties of consent managers (Rule 4) |
| Phase 3 | 13 May 2027 | Notice, consent, data principal rights, security, breach reporting, children's data and significant data fiduciary duties |
Core obligations for a startup acting as data fiduciary
From May 2027, a startup needs a lawful basis for each use of personal data, which in most product flows means consent. Consent must follow a clear notice that explains what data is collected and why, and the person must be able to withdraw it as easily as they gave it. You must also keep reasonable security safeguards, honour requests to access, correct and erase data, and run a grievance channel.
Grievances have a hard ceiling. The Rules require them to be resolved within a reasonable time that cannot exceed 90 days. In product terms, that means a ticket queue with timestamps, an owner and an audit trail, not an unmonitored email inbox.
- Map every place personal data enters, is stored or leaves your systems
- Write a plain-language notice for each collection point
- Build consent capture and withdrawal into sign-up and settings screens
- Set up a grievance and rights-request workflow with a 90-day limit
- Sign data processing terms with vendors who handle personal data for you
Breach notification: the 72-hour report
When a personal data breach happens, the Rules ask for two reports to the Board. The first is an initial intimation without delay after you become aware of the breach. The second is a detailed report within 72 hours, unless the Board allows more time on a written request. Affected individuals must also be told without delay, though the Rules set no fixed number of hours for them.
The Board itself works to a timetable. MediaNama's reading of the Rules says inquiries must finish within six months of a complaint or intimation, with extensions in blocks of three months that need written reasons. Appeals against Board orders go to TDSAT. Separately, many startups also fall under CERT-In's six-hour reporting rule for cyber incidents, so one incident can trigger both clocks.
Retention, erasure and logs
Personal data should be erased once its purpose is served, but the Rules also set a floor. Under Rule 8(3), personal data, traffic data and logs linked to processing must be kept for at least one year, even after the purpose ends or the account is deleted, for purposes listed in the Seventh Schedule. Breach-detection logs follow the same one-year minimum unless another law asks for longer.
Large platforms face an extra limit. E-commerce entities and social media intermediaries with 2 crore or more registered users in India, and online gaming intermediaries with 50 lakh or more, must erase data of inactive users after three years. They must warn the user 48 hours before deletion. Most early-stage startups sit below these thresholds, but the one-year log rule applies broadly.
Children's data and significant data fiduciaries
Anyone under 18 counts as a child under the Act. Before processing a child's data you need verifiable consent from a parent or lawful guardian, and you must take reasonable steps to confirm that the person consenting is an identifiable adult. Edtech, gaming and social products should plan age checks and parental consent flows early, because these change sign-up design.
The government can designate some companies as significant data fiduciaries based on the volume and sensitivity of the data they handle. These firms must run an annual Data Protection Impact Assessment and an independent data audit, report significant findings to the Board, and carry out algorithmic due diligence. A January 2026 MeitY proposal also suggested earlier deadlines for this group.
Penalties under the DPDP Schedule
The Act sets maximum penalties by type of breach in its Schedule. These are ceilings, and the Board decides the actual amount after an inquiry. The largest figures attach to security and breach reporting failures, which is why security engineering is the first place to invest. The Board can also accept voluntary undertakings, and breaching an undertaking can attract the penalty for the original breach.
| Breach | Section | Maximum penalty |
|---|---|---|
| Failure to keep reasonable security safeguards | 8(5) | ₹250 crore |
| Failure to notify the Board and individuals of a breach | 8(6) | ₹200 crore |
| Breach of additional obligations for children | 9 | ₹200 crore |
| Breach of significant data fiduciary obligations | 10 | ₹150 crore |
| Breach of any other provision of the Act or Rules | Residual | ₹50 crore |
| Breach of duties by a data principal | 15 | ₹10,000 |
A practical starting plan for startups
Start with a data inventory, then fix the controls that carry the largest penalties: access control, encryption, logging and an incident response plan that can produce a detailed report in 72 hours. Next, rebuild notices and consent screens, and add a rights-request queue. Review vendor contracts last, but before May 2027. XDQ Labs builds consent flows, audit logging and security testing for product teams preparing for DPDP.
This guide summarises the Act, the Rules and the public commentary listed below, as of November 2026. It is not legal advice. Rules and timelines may change through amendment, so confirm how they apply to your business, and the current dates, with qualified counsel before you act.
Frequently asked questions
When does the DPDP Act fully apply to startups?
The core duties, including notice, consent, security safeguards and breach reporting, start on 13 May 2027, 18 months after the Rules were notified in November 2025. Consent manager rules start on 13 November 2026. MeitY proposed shortening the window in January 2026, so check for any amendment.
What is the maximum penalty under the DPDP Act?
The highest ceiling in the Schedule is ₹250 crore, for failing to keep reasonable security safeguards against a personal data breach. Failing to report a breach, or breaching duties for children's data, can each attract up to ₹200 crore. The Board sets the actual amount after an inquiry.
How quickly must a data breach be reported under the DPDP Rules?
You must inform the Data Protection Board without delay, then send a detailed report within 72 hours of becoming aware of the breach, unless the Board allows more time. Affected individuals must also be told without delay. These duties start with the core obligations in May 2027.
Do startups get any exemption under the DPDP Act?
The sources reviewed for this guide describe no blanket exemption for startups. The 18-month phased rollout was meant partly to give startups and small enterprises time to adapt, and the heaviest inactive-user erasure rules only hit large platforms. Confirm any exemption you plan to rely on with counsel.
Sources
- ERGO: Digital Personal Data Protection Rules, Khaitan & Co, 2025
- India notifies DPDP Rules 2025, activates Data Protection Board, MediaNama, 2025
- DPDP Act: The Schedule, dpdpa.com, 2023
- MeitY plans to cut short DPDP compliance timeline and notify cross border restrictions for SDFs, S.S. Rana & Co., 2026
- When does India's DPDP law begin full enforcement? 2026 to 2027 timeline explained, India Briefing, 2026
- DPDP Act 2023 and Rules 2025: phased implementation timeline, Sansa Legal, 2025
- Digital Personal Data Protection Rules 2025: provisions, implementation plan, penalties, BDO India, 2025
- Digital Personal Data Protection Rules, 2025, Wikipedia, 2026
